Zero Knowledge Discrete Logarithm on Elliptic Curves

Question

Can the Discrete Logarithm ZK be implemented on elliptic curves? It seems that such an implementation should look like the following:

$Y = \alpha G$
Random pick $v$
$t = vG$
$c = H(G, y, t)$
$r = v - cx$
Check: $t = rG + cY$

If yes, can I use ed25519 for this purpose and how can I select $G$?

Geoffroy Couteau · Accepted Answer · 2021-07-20T08:57:53.777

1

Yes, this non-interactive zero-knowledge proof works perfectly fine (with a suitable hash function) for proving knowledge of a discrete logarithm over e.g. ed25519. The basis $G$ is part of the statement: the statement is of the form "I know $\alpha$ such that $Y = G^\alpha$. As such, it works for any generator $G$ of your choice (which, over ed25519, is any element of the prime order subgroup except $0$, since its a prime order cyclic group).

edited Jul 20 '21 at 08:57

answered Jul 19 '21 at 16:28

Geoffroy Couteau

19,919
2
46
68

Great! Thank you! But why G can be any element? As far as I know not all elements of a cyclic group are the generators – Кирилл Волков Jul 19 '21 at 17:59
You are right sorry, I typed too fast - I meant, since ed25519 is a prime order cyclic group, all its elements (beyond the neutral element, i.e., $g^0$) are generators. – Geoffroy Couteau Jul 19 '21 at 20:43
I think you need to be more careful about the claim that $G$ can be any element on the elliptic curve. The full group of elliptic curve points does not have prime order; it has a small cofactor. So, not every non-identity element is a generator. But every non-identity element of the large prime-order subgroup generates that subgroup. – Chris Peikert Jul 20 '21 at 03:24
Something like the Ristretto group solves that issue, or you could take the standardized Ed25519 basepoint. – Ruben De Smet Jul 20 '21 at 06:48
Fixed the confusing statement, hopefully - I had the prime order subgroup in mind when saying "the elliptic curve", which of course is incorrect. – Geoffroy Couteau Jul 20 '21 at 08:58
@GeoffroyCouteau Thank you very much!! – Кирилл Волков Jul 21 '21 at 13:32

Zero Knowledge Discrete Logarithm on Elliptic Curves

1 Answers1

Linked